CVE-2026-107848

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107848

Affected Vendors & Products

Vendor	Product	Version / Range
contao	contao	>= 4.0.0, < 5.3.50
contao	contao	>= 5.4.0-RC1, < 5.7.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Contao CMS versions 4.0.0 to 5.3.50 and 5.7.12 have a vulnerability where RequestTokenListener only validates CSRF tokens for POST requests. GET requests with an act parameter bypass this check, allowing backend actions to execute without a valid token when an authenticated user visits a malicious URL. This could lead to unauthorized state changes or destructive actions within the user's permissions.

Detection Guidance

To detect this vulnerability, check Contao CMS versions between 4.0.0 and 5.3.50 or 5.7.12 for backend actions triggered via GET requests without a valid REQUEST_TOKEN. Inspect server logs for GET requests containing 'act' or 'key' parameters in backend URLs. No specific commands are provided in the context.

Impact Analysis

If you use a vulnerable Contao CMS version, an attacker could trick you into clicking a link that performs unwanted backend actions, such as deleting content or modifying settings, without your knowledge. The impact is limited to actions your user account is permitted to perform.

Compliance Impact

This vulnerability could lead to unauthorized modifications of data, potentially violating integrity requirements in GDPR or HIPAA. If exploited, it may result in non-compliance due to unauthorized changes to sensitive information or system configurations.

Mitigation Strategies

Upgrade Contao to versions 5.3.50 or 5.7.12 or later to fix the vulnerability.

Hi! I’m here to help you understand CVE-2026-107848. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70